Splunk Administrator / Platform Support Engineer (Production Support)

Job Overview

We are seeking a Splunk Administrator / Platform Support Engineer to provide ongoing maintenance and support for a Splunk environment hosted on a dedicated infrastructure platform (“Gemini”).

This role focuses on Splunk administration, production support, monitoring, and dashboard development, with periodic onsite support at the DMV location.

Key Responsibilities

• Provide Splunk administration and L2/L3 production support for enterprise environments
• Perform data ingestion, log onboarding, parsing, and indexing in Splunk
• Develop and maintain Splunk dashboards, reports, alerts, and SPL queries
• Monitor system performance and conduct health checks, tuning, and optimization
• Troubleshoot production issues, incidents, and data discrepancies
• Perform software upgrades, patching, and configuration management
• Support integration with external systems, APIs, and data sources
• Ensure data accuracy, log validation, and proper field extraction
• Collaborate with business users to build dashboards and reporting use cases
• Provide documentation, training, and knowledge transfer

Required Skills (Dice High-Match Keywords)

• 5+ years of experience in Splunk Administration / Splunk Engineering
• Strong expertise in Splunk (SPL, dashboards, alerts, data ingestion, indexing)
• Experience in production support / application support / L2-L3 support environments
• Hands-on with log analysis, monitoring, and observability tools
• Experience with Linux/Unix systems and basic system administration
• Strong knowledge of data parsing, field extraction, and log management
• Experience with SQL and basic scripting (Python/Shell)
• Knowledge of REST APIs, JSON, and data integrations
• Strong troubleshooting and root cause analysis skills

Nice to Have (Boosts Visibility)

• Experience with Splunk Enterprise Security (SIEM)
• Familiarity with cloud platforms (AWS / Azure)
• Exposure to DevOps tools (Git, Jenkins, CI/CD)
• Experience with Kafka / streaming / real-time log ingestion
• Prior experience with state or government clients

Work Model

• Onsite: 3 days/month (Richmond, VA – mandatory)
• Remote: Ongoing support, monitoring, and issue resolution

Ideal Candidate

• Strong hands-on Splunk Admin / Splunk Engineer
• Experience handling production support independently
• Comfortable working in low-frequency onsite, high-responsibility roles
• Able to support both technical operations and business reporting needs